Scale workloads in shared and dedicated VPC environments

Objectives

• Learn how to set up a multi-zone VPC with instance autoscaling.
• Understand the concepts of public and private load balancing.
• Learn how to scale instances dynamically or periodically.
• Learn the use of dedicated hosts.

1. The frontend app deployed on VSI(s) communicates to the backend app via the private load balancer.
2. The backend app securely communicates with the cloud services via a virtual private endpoint (VPE).
3. As the load on the application increases, scaling for VPC is enabled and dynamically adds or removes VSIs based on metrics like CPU, RAM, etc., or through scheduled scaling.
4. As the scope expands, dedicated host isolates and performs heavy computation on the data. Resize the instance on the dedicated host by updating the profile based on your requirement. Also, expand the block storage volume capacity.
5. All instances communicate with IBM Cloud services over the private backbone using a virtual private endpoint (VPE). See the About virtual private endpoint gateways topic for more details.

Before you begin

The tutorial requires:

• An IBM Cloud billable account.
• A local shell with curl.

Enable logging and monitoring

1. Configure a IBM Cloud Logs instance as a target of IBM Cloud Logs Routing. See Getting started with IBM® Cloud Logs Routing
2. Configure a Monitoring instance to collect platform metrics. See Enabling platform metrics

Provision required cloud services

In this section, you will create the following cloud services required for the application using IBM Cloud Schematics: IBM Cloud Databases for PostgreSQL and IBM Cloud Object Storage.

1. Navigate to Schematics Workspaces, click on Create workspace.
   1. Under the Specify Template section, provide https://github.com/IBM-Cloud/vpc-scaling-dedicated-host under GitHub or GitLab repository URL.
   2. Select terraform_v1.5 as the Terraform version and click Next.
2. Under Workspace details,
   1. Provide a workspace name : vpc-scaling-workspace.
   2. Choose a Resource Group and a Location.
   3. Click on Next.
3. Verify the details and then click on Create.
4. Under Variables, set step1_create_services to true by clicking the action menu in the row > Edit, uncheck Use default, choose true from the Override Value dropdown, and click on Save.
5. Set any additional variables you would like to override, the most typical ones are region, resource_group_name.
6. Scroll to the top of the page and click Generate plan. This is the same as terraform plan command.
7. Click on Show more to check the resources to be provisioned.
8. Navigate to the workspace page using the breadcrumb menu and click on Apply plan. Check the logs to see the status of the services created.

Navigate to the resource list. Here, you can filter by the basename used to create the resources, i.e., vpc-scaling, and you will see the cloud services required for this tutorial provisioned in the resource group you specified. All the data stored with these services is encrypted with a key generated and stored in IBM Key Protect for IBM Cloud.

Set up a multizone Virtual Private Cloud

In this section, you will:

• Provision an IBM Cloud® Virtual Private Cloud (VPC) with subnets spanning across two zones. To ensure the high availability of your frontend app and backend app, you will create multiple VSIs across these zones.
• Configure a public load balancer for your frontend and a private load balancer for your backend app to provide high availability between zones.
• Create an instance template used to provision instances in your instance group.

Initially, you may not deploy all the infrastructure resources to make it scale, even if you designed it in that way. You may start with only one or a few instances, as shown below.

As the load increases, you may need more instances to serve the traffic. You may configure a public load balancer for the frontend app and a private load balancer for the backend app to equally distribute incoming requests across instances. With a load balancer, you can configure specific health checks for the pool members associated with instances.

An instance template is required before you can create an instance group for auto scaling. The instance template defines the details of the virtual server instances that are created for your instance group. For example, specify the profile (vCPU and memory), image, attached volumes, and network interfaces for the image template. Additionally, user data is specified to automatically run initialization scripts required for the frontend and backend applications respectively. All of the VSIs that are created for an instance group use the instance template that is defined in the instance group. The script provisions an instance template and an instance group (one for frontend and one for backend) with no auto scaling policies defined yet. This example does not require data volumes so they are commented out in the modules/create_vpc/autoscale/main.tf ibm_is_instance_group resource.

VPC uses cloud-init technology to configure virtual server instances. The user data field on the new virtual server for VPC page allows users to put in custom configuration options by using cloud-init.

Increase load on your instances to check scaling

In this section, you will start scaling the instances with the scaling method initially set to static. Then, you move to scaling the instances with dynamic scaling by setting up an instance manager and an instance group manager policy. Based on the target utilization metrics that you define, the instance group can dynamically add or remove instances to achieve your specified instance availability.

Set up a dedicated host and provision a VSI with an encrypted data volume

Provisioning dedicated hosts will incur costs. Use the Cost Estimator to generate a cost estimate based on your projected usage.

In this section, you will create a dedicated host in a group and provision an instance with an encrypted data volume.

The reason you create a dedicated host is to carve out a single-tenant compute node, free from users outside of your organization. Within that dedicated space, you can create virtual server instances according to your needs. Additionally, you can create dedicated host groups that contain dedicated hosts for a specific purpose. Because a dedicated host is a single-tenant space, only users within your account that have the required permissions can create instances on the host.

1. Navigate to the Settings tab of your Schematics workspace, update the step4_create_dedicated variable to true and Save the setting.

2. Click on Apply the plan to provision the following resources,

   • a dedicated host group
   • a dedicated host
   • a VSI with encrypted data volume (encryption using IBM Key Protect for IBM Cloud) and with a security group attached.

   

3. From the log output, copy the instance IP address and launch Cloud Shell to run the below command by replacing the placeholder <IP_ADDRESS> with the instance IP address

   export INSTANCE_IP=<IP_ADDRESS>
   

   Typically, you won't set a public IP (floating IP) for an instance. In this case, a floating IP is set allow curl to the app deployed on the instance.

4. Issue the following curl command to query the database. The application running on the instance will read content from the Databases for PostgreSQL over the private endpoint. The data is the same that is available from the frontend application.

   curl \
   -s -X POST \
   -H "Content-Type: application/json" \
   --data '{ "query": "query read_database { read_database { id balance transactiontime } }" }' \
   http://$INSTANCE_IP/api/bank
   

5. Issue the following curl command to query the COS bucket. The application running on the instance will read content from the Object Storage and return the results in JSON format. The data stored in COS is only available to the application running from the instance on the dedicated host.

   curl \
   -s -X POST \
   -H "Content-Type: application/json" \
   --data '{ "query": "query read_items { read_items { key size modified } }" }' \
   http://$INSTANCE_IP/api/bank
   

6. Issue the following curl command to query the database and COS bucket at once. The application running on the instance will read content from the Databases for PostgreSQL and Object Storage and return the results in JSON format.

   curl \
   -s -X POST \
   -H "Content-Type: application/json" \
   --data '{ "query": "query read_database_and_items { read_database { id balance transactiontime } read_items { key size modified } }" }' \
   http://$INSTANCE_IP/api/bank
   

Resize the VSI and expand the attached block storage volume on the dedicated host

If you have observed the profile of the instance provisioned on the dedicated host, it is set to cx2-2x4 where c stands for Compute family (category) with 2 vCPUs and 4 GiB RAM. In this section, you will resize the instance by updating the profile to cx2-8x16 with 8 vCPUs, 16 GiB RAM.

In this section, you will also expand the block storage volume attached to the VSI from 100 GB to 250 GB. To understand the maximum capacity on the selected volume profile, check expanding block storage volume capacity

What's next?

Extend the scenario by configuring SSL termination, sticky sessions, and end-to-end encryption. For more information, refer to this blog post.

Remove resources

To remove the Schematics workspace and its resources, follow these steps:

1. Navigate to Schematics workspaces and select your workspace.
2. Click on the Actions... drop down and click Destroy resources to clean up all the resources that were provisioned via Schematics.
3. Click on the Actions... drop down and click Delete workspace to delete the workspace.

Depending on the resource it might not be deleted immediately, but retained (by default for 7 days). You can reclaim the resource by deleting it permanently or restore it within the retention period. See this document on how to use resource reclamation.

Related content

• Securely access remote instances with a bastion host
• Accessing virtual server instances by using VNC or serial consoles
• Getting started with IBM Cloud Hyper Protect Crypto Services